Changelog

Name: QWED
Author: QWED

Follow the evolution of QWED — every release, feature, and security patch documented here.

v5.2.0June 19, 2026Latest

Structured Verification Diagnostics 🧭

An architectural completion release that standardizes how every engine reports its result. Introduces the unified 3-layer DiagnosticResult model, replacing inconsistent per-engine outputs (ad-hoc dictionaries, incompatible dataclasses, and unstructured tuples) with a single diagnostic contract. Additive-only — no engine return types, API shapes, or SDK signatures change.

Unified DiagnosticResult Model

A single result type replaces three incompatible VerificationResult dataclasses and ad-hoc per-engine dictionaries
Diagnostics are separated by audience into three explicit disclosure layers
Establishes the diagnostic contract that verification engines adopt in subsequent patches

Tri-State Verdict Taxonomy

Every verification now resolves to exactly one of VERIFIED, UNVERIFIABLE, or BLOCKED — no other variants
VERIFIED is structurally enforced: the constructor raises if a VERIFIED result is created without a proof reference
Removes ambiguity between "could not verify" and "actively blocked" outcomes

Three Disclosure Layers

Layer 1 — agent_message: a model-facing summary that never contains detection logic, rule IDs, regex patterns, or bypass guidance
Layer 2 — developer_fields: structured evidence including constraint IDs, expected/actual values, advisory checks, and methods used
Layer 3 — proof_ref: a sha256 cryptographic hash of the retained proof artifact, present only when status is VERIFIED (the "authority bit")

Compatibility & Scope

Additive-only: existing engine return types are unchanged
No new engines, confidence scores, or explainability layers introduced
83 new tests added; version propagated to 5.2.0 across PyPI, npm, Rust, and Docker artifacts

Minor Release Architecture Governance Diagnostics

GitHub Release PyPI Docker Hub

v5.1.2June 14, 2026

SymPy Expression Injection Fix 🔐

An emergency security patch fixing a high-severity authenticated RCE vulnerability (CWE-95, CVSS 8.8) in SymPy’s parse_expr() across all math verification paths. Upgrading is strongly recommended for any deployment exposing math verification.

Security — CWE-95 (CVSS 8.8)

Added safe_parse_expr() with a denylist, stripped __builtins__, an allow-listed math namespace, per-call global dict copies, and pre/post-parse validation
Replaced direct parse_expr() calls across main.py, verifier.py, batch.py, and validator.py
Defense-in-depth: pre-parse AST depth limits, post-parse tree-depth validation, sympy.Expr type enforcement (relationals rejected), extra_symbols validation, and sanitized exception handling

Correctness & Reliability

Added get_safe_symbol() to match SymPy symbol assumptions and prevent incorrect diff/integrate/limit results
Fail-closed Redis backend for distributed cache mode
Restored TypeScript SDK package-lock.json for reliable npm ci; added CodSpeed performance benchmark workflow

Security Patch CWE-95 Math Engine

GitHub Release PyPI Docker Hub

v5.1.1May 22, 2026

Trust Boundary Hardening 🛡️

A correctness and fail-closed follow-through release, packaging trust-boundary corrections that landed after v5.1.0. Focused on replay resistance, attestation integrity, and closing residual fail-open paths.

Replay Resistance & Attestation

Cache keys now bind to the full trust context (provider, model, policy version, session/tenant) — any change forces a cache miss
create_verification_attestation() returns an explicit AttestationResult on all paths; status is now an AttestationStatus enum with fail-closed is_issued enforcement
IssuerKeyPair adds generated_at and an allowlisted key_continuity_policy

Audit & Proof Path Corrections

Malformed audit payloads fail closed; org-level audit chains isolated; SQLite uses BEGIN IMMEDIATE transactions
Reasoning now requires satisfied proof prerequisites; batch math simplification separated from the proof path
Symbolic verifier returns BLOCKED when no proof exists

Agent, Schema & CI Hardening

Unknown agent actions denied and logged; secure executor hard-blocks unrecognized input shapes
Strict additionalProperties: false schema enforcement
PyPI publishing switched to an OIDC Trusted Publisher with pinned action revisions

Patch Security Correctness

GitHub Release PyPI Docker Hub

v5.1.0April 19, 2026

Agent State Governance & Fail-Closed Hardening 🛡️

QWED v5.1.0 extends the verification boundary beyond actions and into deterministic state governance. Introduces AgentStateGuard and a focused hardening wave that closes the post-v5.0.0 fail-open paths identified during adversarial review — a stricter system that is more explicit about what it proves, harder to bypass under uncertainty, and safer under agentic workflows.

Headline Feature — AgentStateGuard

Strict structural validation for agent state payloads — malformed state no longer slips through
Semantic transition checks between current and proposed state
Replay-resistant, monotonic transition enforcement — stops rollback and out-of-order state writes
Governed atomic commit behavior for approved state writes — agent state is no longer just "well-formed", it is deterministically checked before becoming reality

Execution & Tool Governance

CodeExecutor is now permanently hard-blocked as a legacy execution path — migrate direct imports to SecureCodeExecutor
Unknown tools are now denied by default instead of being auto-approved at low heuristic risk — explicit allowlisting required

Math & API Semantics Fail-Closed

verify_math() now enforces deterministic tolerance bounds — oversized or invalid tolerances return BLOCKED
Ambiguous /verify/math expressions now fail closed with BLOCKED and is_valid: false
verify_identity() now rejects sampling-only agreement when no formal proof exists — returns BLOCKED instead of UNKNOWN
verify_logic_rule() now fails explicitly instead of returning an ambiguous None

Schema Enforcement

SchemaVerifier now fails closed when uniqueItems cannot be verified deterministically
uniqueItems verification failures now produce explicit schema errors instead of silent passes

Agent & Runtime Follow-Through

Progress-aware doom loop protection (LOOP-004) — agents can no longer spin indefinitely on non-progressing steps
Continued infrastructure and config hardening across CI and deployment paths
Additional stats engine edge-case coverage
CodeQL and cleanup follow-up work to close remaining syntax and test alerts

Upgrade Notes

CodeExecutor can no longer be used — migrate direct imports to SecureCodeExecutor
Unknown tools now require explicit allowlisting
verify_math() may return BLOCKED for oversized or invalid tolerances
verify_logic_rule() now raises instead of returning None
verify_identity() sampling-only matches now return BLOCKED, not UNKNOWN
Ambiguous /verify/math inputs now return BLOCKED with is_valid: false
uniqueItems verification failures now produce explicit schema errors instead of silent passes

Minor Release Security Governance Agent State

GitHub Release PyPI Docker Hub

v5.0.0April 3, 2026

Enforcement Boundary Hardening 🔒

A major hardening release focused on making the verification boundary fail-closed, deterministic, and substantially harder to bypass. Includes 98 commits, 20 merged PRs, the full enforcement series, supply-chain hardening, and aligned SDK/package versions.

Fail-Closed Verification & Execution

Removed unsafe in-process execution fallbacks on protected paths — secure Docker-only execution enforced for sensitive flows
Secure-runtime failures now produce explicit blocked states instead of silently degrading
Consensus can no longer weaken requested assurance depth when secure execution is unavailable
Redis-backed rate limiting now fails closed on backend errors

Critical Security Boundary Closures

Eliminated the logic verifier eval() fallback — SafeEvaluator is now required
Fixed consensus fact self-attestation behavior
Internal exception details no longer leak in client-facing verification responses
Blocked and secure-runtime failure states now surface correctly at endpoint level

Runtime & Agent Hardening

ActionContext is now mandatory for agent verification — security guards are server-enforced, not client-optional
Added deterministic replay detection and repetitive-loop blocking for agents
Denied and budget-exceeded actions no longer incorrectly consume conversation state
Agent token verification switched to constant-time hmac.compare_digest
/metrics and /metrics/prometheus now require authenticated privileged access

Determinism & Trust-Boundary Alignment

Natural-language math no longer presents LLM-mediated interpretation as formally verified truth — returns INCONCLUSIVE when appropriate
Explicit trust_boundary metadata describes what was actually proven
Symbolic identity numerical-sampling fallback returns UNKNOWN instead of over-claiming equivalence
UNKNOWN, BLOCKED, and INCONCLUSIVE are now first-class result states that consumers must handle

Supply-Chain & CI Hardening

Pinned third-party GitHub Actions revisions for reproducible builds
Merged supply-chain hardening and security autofix work across PRs #100–#120
Added canonical enforcement guidance and contributor review policies

Major Release Security Enforcement Governance

GitHub Release PyPI Docker Hub

v4.0.1March 23, 2026

Sentinel Guard Sync 🔄

Patch release aligning the TypeScript SDK, backend API schemas, and security guard integrations introduced in v4.0.0 Sentinel Edition. Addresses all critical findings from Sentry, CodeRabbit, SonarCloud, and CodeQL during PR #97 review.

New Endpoints

POST /verify/process — Glass-box reasoning process verifier with IRAC mode (validates AI reasoning traces) and Milestones mode (checks custom milestone completion)
POST /agents/{id}/verify — Now accepts optional security_checks: ExfiltrationGuard scans for PII, MCPPoisonGuard detects prompt injection and unauthorized URLs

Security Fixes

Information Disclosure — /verify/rag error responses no longer leak internal file paths, DB credentials, or stack traces; exceptions logged server-side via redact_pii()
Symbolic Precision — max_drm_rate now accepts str only (e.g., "0", "1/10") with fractions.Fraction validation, preventing floating-point approximation issues
Response Consistency — Error responses now return "verified": false instead of "is_valid": false, matching the RAGGuard success schema

SDK Changes — @qwed-ai/sdk@4.0.1

New method: verifyProcess(trace, options?) — IRAC structure or milestone validation
Breaking: verifyRAG() maxDrmRate changed from number to string for symbolic precision alignment
Fixed: verifyAgent() return type aligned with AgentVerificationResponse schema
Fixed: Agent IDs now URL-encoded via encodeURIComponent() across verifyAgent, verifyAgentAction, getAgentBudget

Patch Security SDK

GitHub Release PyPI Docker Hub

v4.0.0March 12, 2026

Sentinel Edition 🛡️

The largest update in QWED history — 147 commits. Introduces Agentic Security Guards, Process Determinism, critical security hardening, and enterprise-grade CI/CD infrastructure.

Agentic Security Guards (Phase 17)

RAGGuard — Detects prompt injection, data poisoning, and context manipulation in RAG pipelines
ExfiltrationGuard — Prevents data exfiltration through AI agent tool calls
MCP Poison Guard — Detects poisoned MCP tool definitions before agent execution

New Standalone Guards

SovereigntyGuard — Data residency and local routing enforcement (GDPR)
ToxicFlowGuard — Stateful detection of toxic tool-chaining patterns
SelfInitiatedCoTGuard (S-CoT) — Reasoning integrity verification

Process Determinism

ProcessVerifier — IRAC/milestone-based process verification with decimal scoring and compliance reporting

Security Hardening

Replaced all eval() with AST-compiled execution
Patched sandbox escape, SymPy injection, and protocol bypass vulnerabilities
Resolved CVE-2026-24049 (Critical), 19 Snyk findings, and CodeQL alerts

Docker & CI/CD

15+ Docker hardening improvements — pinned digests, non-root, SBOM
Sentry SDK, CircleCI matrix (3.10–3.12), SonarCloud, Snyk integration
Automated Docker Hub publishing on release

Major Release Security Agentic AI Docker

GitHub Release PyPI Docker Hub

v3.0.1February 4, 2026

Ironclad Update 🦾

Critical security hardening and enterprise compliance update.

Security Hardening

CodeQL remediation — resolved 50+ alerts including ReDoS, clear-text logging, exception exposure
Enforced least privilege permissions across all CI/CD workflows
Implemented robust PII redaction in all API endpoints